The tests I have seen are more like a macro enabled office document attatched to an email that says it is from an address actually on the corporate email server

The tests I have seen are more like a macro enabled office document attatched to an email that says it is from an address actually on the corporate email server. And it has a line like "review my schedule update, a week less for test creation is fine right?". Except I don't work with the sender and the corporate firewall as marked as having actually been sent from outside.